THE WILD OUTDOORS PRIVACY NOTICE FOR PARENTS
THE WILD OUTDOORS EDUCATION COMPANY
PRIVACY NOTICE
Last updated: 10/12/2025
1. Introduction
The Wild Outdoors Education Company is committed to protecting and respecting your privacy and your child’s privacy.
The Wild Outdoors delivers daytime and overnight activity camps, residential programmes, and expeditions for children and young people across the United Kingdom. In this privacy notice, references to “we”, “us”, “our”, or “The Wild Outdoors” refer to The Wild Outdoors Education Companies and the specific activity camp which your child is attending, has attended, or may attend.
This privacy notice explains how we collect, use, store, and protect personal data relating to you and your child. Please read it carefully.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, The Wild Outdoors Education Company is the Data Controller.
Trading address:
2 Riverview Cottages
Lilliesleaf
TD6 9JB
ICO Registration Number: ZA937821
This notice is reviewed regularly and updated whenever our processing activities change. If you are viewing this notice online, we recommend saving or printing a copy for your records.
2. Information We Collect
2.1 Information you provide to us
You may provide personal data about you and/or your child when you:
- Use or interact with our website (e.g. enquiry or registration forms)
- Book or attend one of our day or residential camps
- Correspond with us by email, phone, or post
- Complete registration, consent, medical, safeguarding, or payment forms
2.2 Types of personal data we may collect
This may include:
- Full name
- Date of birth
- Gender
- Contact details (address, email, telephone numbers)
- Parent/guardian relationship to the child
- Website login details (where relevant)
- Financial and payment details
- Education, medical, or health information (including SEN, allergies, injuries)
- GP surgery details
- Camp attendance history
Some personal data is required in order for your child to attend safely (for example, emergency contact and medical information). If required information is not provided, we may be unable to accept or safely care for your child. Other information (such as marketing preferences or demographic data) is optional.
3. Information We Receive From Other Sources
Where appropriate, we may receive personal data from third parties, including:
- Schools and education authorities
- Medical practitioners or health professionals
- Local authorities or safeguarding agencies
- Photographers (where consent is given)
- Payment providers or professional advisers
We only receive and use such information where it is necessary for safeguarding, service delivery, or legal compliance.
4. How We Use Personal Information and Our Lawful Bases
Under UK GDPR, we must identify a lawful basis for processing personal data. We process data for the purposes below:
| Purpose | Data types | Lawful basis |
|---|---|---|
| Camp booking and delivery | Identification, contact, medical data | Performance of a contract |
| Safeguarding and child welfare | Health, medical, SEN, incident data | Vital interests / safeguarding obligations |
| Managing records and systems | Attendance and operational data | Legitimate interests |
| Payments and invoicing | Financial data | Performance of a contract / legal obligation |
| Marketing similar services | Contact details | Legitimate interests (opt-out available) |
| Photographs and media | Images / video | Consent |
5. Special Category Data (Health & Safeguarding)
Where we process special category personal data (such as medical or health information), we do so in accordance with Article 9 of UK GDPR, relying on one or more of the following lawful bases:
- Explicit consent from a parent or guardian
- Protection of a child’s vital interests
- Safeguarding and child protection obligations
- Provision of health care or medical treatment
This may include securely storing information about allergies, medical conditions, or injuries so staff can respond appropriately in an emergency.
6. Technology and Data Processors
We use secure management systems and vetted third-party service providers, such as booking systems, management information systems, payment processors, and cloud storage providers.
All third-party processors act under written data-processing agreements and are required to maintain appropriate security, confidentiality, and UK GDPR compliance.
7. Sharing Personal Information
We may share personal data where necessary or legally required, including with:
- Local authorities, safeguarding teams, or police where welfare concerns arise
- UK Visas and Immigration (where applicable)
- Professional advisers or regulators
We do not sell personal data and only share information where required for safeguarding, legal compliance, or service delivery.
8. Consent and Withdrawal
We seek explicit consent where required, including for:
- Marketing communications not covered by legitimate interest
- Use of photographs or video of your child for promotional purposes
You may withdraw consent at any time by emailing hello@thewildoutdoors.org or updating your preferences where applicable. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
You are not required to provide information about race, religion, or ethnicity. If provided, it is used only for operational or equality-monitoring purposes.
9. International Data Transfers
We do not routinely transfer personal data outside the UK or European Economic Area (EEA). Where transfers are necessary, appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.
10. Your Rights Under UK GDPR
You and your child have the right to:
- Access personal data we hold
- Request correction of inaccurate data
- Request erasure of personal data
- Restrict processing
- Object to processing
- Request data portability
- Object to direct marketing
- Withdraw consent where applicable
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
Website: www.ico.org.uk
We encourage you to contact us first so we can address any concerns promptly.
11. Data Retention
We retain personal data only for as long as necessary, in line with our data retention policy. As a general guide:
- Safeguarding and incident records may be kept longer if legally required
- Financial records are retained in line with HMRC requirements
- Children’s general attendance records are deleted when the child reaches approximately age 14, unless a lawful reason exists to retain them
12. Website Security
Where login details are provided, you are responsible for keeping passwords confidential. While internet transmission cannot be guaranteed as fully secure, we use appropriate technical and organisational measures to protect personal data.
If a personal data breach occurs that poses a risk to individuals’ rights and freedoms, we will notify affected individuals and the ICO where required by law.
13. Automated Decision-Making
We do not use automated decision-making or profiling in relation to parents or children.
14. Contact Us
If you have questions or wish to exercise your data protection rights, please contact:
Data Protection Officer
The Wild Outdoors Education Company
Email: hello@thewildoutdoors.org
Address:
2 Riverview Cottages
Lilliesleaf
TD6 9JB